General

  • Target

    2f04d21f5d887c611a4028623298ab9ad08cffaa7b94e3f303282720874162f2

  • Size

    567KB

  • Sample

    230423-pjkvpseh5w

  • MD5

    db8e5cb2970d685187df40135d3cbf0b

  • SHA1

    9454335638a447b9102ba3b984502dec7eab7a66

  • SHA256

    2f04d21f5d887c611a4028623298ab9ad08cffaa7b94e3f303282720874162f2

  • SHA512

    a87544bdd4b4232ead4eabd92489203dfca37729c90f9ebe6b9628ae7d3dc6c2408f736f3663301a63329b192d50b1bc4750d31513aaebc5a395ad2398f69fc9

  • SSDEEP

    12288:Jy90uNOLy4nDPBAoiJ/dQ39oNHPriqoZ2Mw+B0S:Jy+DbWHRwyNOqpMw6

Malware Config

Targets

    • Target

      2f04d21f5d887c611a4028623298ab9ad08cffaa7b94e3f303282720874162f2

    • Size

      567KB

    • MD5

      db8e5cb2970d685187df40135d3cbf0b

    • SHA1

      9454335638a447b9102ba3b984502dec7eab7a66

    • SHA256

      2f04d21f5d887c611a4028623298ab9ad08cffaa7b94e3f303282720874162f2

    • SHA512

      a87544bdd4b4232ead4eabd92489203dfca37729c90f9ebe6b9628ae7d3dc6c2408f736f3663301a63329b192d50b1bc4750d31513aaebc5a395ad2398f69fc9

    • SSDEEP

      12288:Jy90uNOLy4nDPBAoiJ/dQ39oNHPriqoZ2Mw+B0S:Jy+DbWHRwyNOqpMw6

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks